A Case-Based Reasoning Method for Locating Evidence During Digital Forensic Device Triage

Graeme Horsman, Christopher Laing, Paul Vickers

Research output: Contribution to journalArticlepeer-review

32 Citations (Scopus)
20 Downloads (Pure)

Abstract

The role of triage in digital forensics is disputed, with some practitioners questioning its reliability for identifying evidential data. Although successfully implemented in the field of medicine, triage has not established itself to the same degree in digital forensics. This article presents a novel approach to triage for digital forensics. Case-Based Reasoning Forensic Triager (CBR-FT) is a method for collecting and reusing past digital forensic investigation information in order to highlight likely evidential areas on a suspect operating system, thereby helping an investigator to decide where to search for evidence. The CBR-FT framework is discussed and the results of twenty test triage examinations are presented. CBR-FT has been shown to be a more effective method of triage when compared to a practitioner using a leading commercial application.
Original languageEnglish
Pages (from-to)69-78
JournalDecision Support Systems
Volume61
Early online date24 Jan 2014
DOIs
Publication statusPublished - May 2014

Fingerprint

Dive into the research topics of 'A Case-Based Reasoning Method for Locating Evidence During Digital Forensic Device Triage'. Together they form a unique fingerprint.

Cite this